feat: studio report + canvas ergonomics and a first-party analyze action

[Hacks4Snacks]

feat: studio report + canvas ergonomics and a first-party analyze action

What & why

This PR ships two engine capabilities that were fully built but had no UI, three table-stakes canvas editor features, and a GitHub Action that also dogfoods our own models. There are no engine or wire-contract changes everything routes through existing seams (IEngineClient, the analyze CLI, the published container image).

Highlights

• Studio Report: a Report toolbar button downloads the self-contained HTML report. The engine call (IEngineClient.report, /v1/model/report, WASM) already existed and was simply never wired to a button; offline, the honest "start the engine" hint surfaces as a toast.
• Studio Snap to grid: React Flow snapToGrid on a shared 16px grid (one constant, reused by the dotted background so they line up).
• Studio Copy / paste / duplicate: Ctrl + C / V / D on selected nodes and the flows between them, with fresh ids, offset placement, and single-entry undo. Flows with an endpoint outside the selection are dropped.
• Studio Canvas search: a top-left search box finds any placed element or flow across every page and jumps to it (switch page -> select -> frame), reusing the analysis panel's jump-to pattern.
• GitHub Action: a first-party composite action.yml - runs the pinned tmforge image, analyzes a model glob, uploads SARIF to code scanning, and gates the build honoring analyze exit codes 0/1/2. SARIF uploads before the gate so results always reach the Security tab.
• CI (dogfood): a new dogfood job analyzes the repo's own .tm7 models (findings are expected and non-gating; only a model the tool cannot read fails) and uploads their SARIF as an artifact.
• Tests: 10 new Studio unit tests (clipboard clone semantics, canvas-search filter/jump).